@@ -7,6 +7,8 @@
 
 ## Unreleased: mitmproxy next
 
+- Fix `Set-Cookie` attribute parsing: prevent subsequent attributes (such as `Secure` or `HttpOnly`) from being swallowed into `Expires` when `Expires` contains non-date or short values (e.g. `Expires=0`), and correctly parse RFC 850 dates with full weekday names.
+  ([#8489](https://github.com/mitmproxy/mitmproxy/pull/8489), @7-Bala)
 - Fix typos in the `save_stream_file` option help, docstrings and examples.
   ([#8494](https://github.com/mitmproxy/mitmproxy/pull/8494), @qodelicious)
 - Fix the global `listen_port` option being applied to proxy modes that don't
 
@@ -136,6 +136,24 @@ def _read_cookie_pairs(s, off=0):
     return pairs, off
 
 
+_WEEKDAYS = {
+    "mon",
+    "tue",
+    "wed",
+    "thu",
+    "fri",
+    "sat",
+    "sun",
+    "monday",
+    "tuesday",
+    "wednesday",
+    "thursday",
+    "friday",
+    "saturday",
+    "sunday",
+}
+
+
 def _read_set_cookie_pairs(s: str, off=0) -> tuple[list[TPairs], int]:
     """
     Read pairs of lhs=rhs values from SetCookie headers while handling multiple cookies.
@@ -156,15 +174,11 @@ def _read_set_cookie_pairs(s: str, off=0) -> tuple[list[TPairs], int]:
 
             # Special handling of attributes
             if lhs.lower() == "expires":
-                # 'expires' values can contain commas in them so they need to
-                # be handled separately.
-
-                # We actually bank on the fact that the expires value WILL
-                # contain a comma. Things will fail, if they don't.
-
-                # '3' is just a heuristic we use to determine whether we've
-                # only read a part of the expires value and we should read more.
-                if len(rhs) <= 3:
+                # 'expires' date values can contain a comma after the weekday
+                # (e.g. RFC 1123 'Wed, ...' or RFC 850 'Wednesday, ...').
+                # We only consume across a comma if the delimiter encountered
+                # is actually a comma and the value read so far is a weekday.
+                if off < len(s) and s[off] == "," and rhs.strip().lower() in _WEEKDAYS:
                     trail, off = _read_value(s, off + 1, ";,")
                     rhs = rhs + "," + trail
 
 
@@ -181,6 +181,47 @@ def set_cookie_equal(obs, exp):
                 ("doo", "dar", ()),
             ],
         ],
+        [
+            "session=abc; Expires=0; Secure; HttpOnly",
+            [
+                (
+                    "session",
+                    "abc",
+                    (("Expires", "0"), ("Secure", None), ("HttpOnly", None)),
+                ),
+            ],
+        ],
+        [
+            "a=b; expires=0, c=d",
+            [
+                ("a", "b", (("expires", "0"),)),
+                ("c", "d", ()),
+            ],
+        ],
+        [
+            "a=b; expires=Wednesday, 21-Oct-2026 07:28:00 GMT; path=/",
+            [
+                (
+                    "a",
+                    "b",
+                    (
+                        ("expires", "Wednesday, 21-Oct-2026 07:28:00 GMT"),
+                        ("path", "/"),
+                    ),
+                ),
+            ],
+        ],
+        [
+            "a=b; expires=Wednesday, 21-Oct-2026 07:28:00 GMT, c=d; path=/",
+            [
+                (
+                    "a",
+                    "b",
+                    (("expires", "Wednesday, 21-Oct-2026 07:28:00 GMT"),),
+                ),
+                ("c", "d", (("path", "/"),)),
+            ],
+        ],
     ]
     for s, expected in vals:
         ret = cookies.parse_set_cookie_header(s)